1# 2# System Server aka system_server spawned by zygote. 3# Most of the framework services run in this process. 4# 5 6typeattribute system_server coredomain; 7typeattribute system_server mlstrustedsubject; 8typeattribute system_server scheduler_service_server; 9typeattribute system_server sensor_service_server; 10 11# Define a type for tmpfs-backed ashmem regions. 12tmpfs_domain(system_server) 13 14# Create a socket for connections from crash_dump. 15type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket"; 16 17allow system_server zygote_tmpfs:file read; 18allow system_server appdomain_tmpfs:file { getattr map read write }; 19 20# For art. 21allow system_server dalvikcache_data_file:dir r_dir_perms; 22allow system_server dalvikcache_data_file:file r_file_perms; 23 24# When running system server under --invoke-with, we'll try to load the boot image under the 25# system server domain, following links to the system partition. 26with_asan(`allow system_server dalvikcache_data_file:lnk_file r_file_perms;') 27 28# /data/resource-cache 29allow system_server resourcecache_data_file:file r_file_perms; 30allow system_server resourcecache_data_file:dir r_dir_perms; 31 32# ptrace to processes in the same domain for debugging crashes. 33allow system_server self:process ptrace; 34 35# Child of the zygote. 36allow system_server zygote:fd use; 37allow system_server zygote:process sigchld; 38 39# May kill zygote on crashes. 40allow system_server zygote:process sigkill; 41allow system_server crash_dump:process sigkill; 42allow system_server webview_zygote:process sigkill; 43allow system_server app_zygote:process sigkill; 44 45# Read /system/bin/app_process. 46allow system_server zygote_exec:file r_file_perms; 47 48# Needed to close the zygote socket, which involves getopt / getattr 49allow system_server zygote:unix_stream_socket { getopt getattr }; 50 51# system server gets network and bluetooth permissions. 52net_domain(system_server) 53# in addition to ioctls whitelisted for all domains, also allow system_server 54# to use privileged ioctls commands. Needed to set up VPNs. 55allowxperm system_server self:udp_socket ioctl priv_sock_ioctls; 56bluetooth_domain(system_server) 57 58# Allow setup of tcp keepalive offload. This gives system_server the permission to 59# call ioctl on app domains' tcp sockets. Additional ioctl commands still need to 60# be granted individually, except for a small set of safe values whitelisted in 61# public/domain.te. 62allow system_server appdomain:tcp_socket ioctl; 63 64# These are the capabilities assigned by the zygote to the 65# system server. 66allow system_server self:global_capability_class_set { 67 ipc_lock 68 kill 69 net_admin 70 net_bind_service 71 net_broadcast 72 net_raw 73 sys_boot 74 sys_nice 75 sys_ptrace 76 sys_time 77 sys_tty_config 78}; 79 80# Trigger module auto-load. 81allow system_server kernel:system module_request; 82 83# Allow alarmtimers to be set 84allow system_server self:global_capability2_class_set wake_alarm; 85 86# Create and share netlink_netfilter_sockets for tetheroffload. 87allow system_server self:netlink_netfilter_socket create_socket_perms_no_ioctl; 88 89# Create/use netlink_tcpdiag_socket for looking up connection UIDs for VPN apps. 90allow system_server self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read }; 91 92# Use netlink uevent sockets. 93allow system_server self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; 94 95# Use generic netlink sockets. 96allow system_server self:netlink_socket create_socket_perms_no_ioctl; 97allow system_server self:netlink_generic_socket create_socket_perms_no_ioctl; 98 99# libvintf reads the kernel config to verify vendor interface compatibility. 100allow system_server config_gz:file { read open }; 101 102# Use generic "sockets" where the address family is not known 103# to the kernel. The ioctl permission is specifically omitted here, but may 104# be added to device specific policy along with the ioctl commands to be 105# whitelisted. 106allow system_server self:socket create_socket_perms_no_ioctl; 107 108# Set and get routes directly via netlink. 109allow system_server self:netlink_route_socket nlmsg_write; 110 111# Kill apps. 112allow system_server appdomain:process { getpgid sigkill signal }; 113 114# Set scheduling info for apps. 115allow system_server appdomain:process { getsched setsched }; 116allow system_server audioserver:process { getsched setsched }; 117allow system_server hal_audio:process { getsched setsched }; 118allow system_server hal_bluetooth:process { getsched setsched }; 119allow system_server hal_codec2_server:process { getsched setsched }; 120allow system_server hal_omx_server:process { getsched setsched }; 121allow system_server mediaswcodec:process { getsched setsched }; 122allow system_server cameraserver:process { getsched setsched }; 123allow system_server hal_camera:process { getsched setsched }; 124allow system_server mediaserver:process { getsched setsched }; 125allow system_server bootanim:process { getsched setsched }; 126 127# Set scheduling info for psi monitor thread. 128allow system_server kernel:process { getsched setsched }; 129 130# Allow system_server to write to /proc/<pid>/* 131allow system_server domain:file w_file_perms; 132 133# Read /proc/pid data for all domains. This is used by ProcessCpuTracker 134# within system_server to keep track of memory and CPU usage for 135# all processes on the device. In addition, /proc/pid files access is needed 136# for dumping stack traces of native processes. 137r_dir_file(system_server, domain) 138 139# Write /proc/uid_cputime/remove_uid_range. 140allow system_server proc_uid_cputime_removeuid:file { w_file_perms getattr }; 141 142# Write /proc/uid_procstat/set. 143allow system_server proc_uid_procstat_set:file { w_file_perms getattr }; 144 145# Write to /proc/sysrq-trigger. 146allow system_server proc_sysrq:file rw_file_perms; 147 148# Delete /data/misc/stats-data/ and /data/misc/stats-service/ directories. 149allow system_server stats_data_file:dir { open read remove_name search write }; 150allow system_server stats_data_file:file unlink; 151 152# Read /sys/kernel/debug/wakeup_sources. 153allow system_server debugfs_wakeup_sources:file r_file_perms; 154 155# The DhcpClient and WifiWatchdog use packet_sockets 156allow system_server self:packet_socket create_socket_perms_no_ioctl; 157 158# 3rd party VPN clients require a tun_socket to be created 159allow system_server self:tun_socket create_socket_perms_no_ioctl; 160 161# Talk to init and various daemons via sockets. 162unix_socket_connect(system_server, lmkd, lmkd) 163unix_socket_connect(system_server, mtpd, mtp) 164unix_socket_connect(system_server, zygote, zygote) 165unix_socket_connect(system_server, racoon, racoon) 166unix_socket_connect(system_server, uncrypt, uncrypt) 167 168# Allow system_server to write to statsd. 169unix_socket_send(system_server, statsdw, statsd) 170 171# Communicate over a socket created by surfaceflinger. 172allow system_server surfaceflinger:unix_stream_socket { read write setopt }; 173 174allow system_server gpuservice:unix_stream_socket { read write setopt }; 175 176# Communicate over a socket created by webview_zygote. 177allow system_server webview_zygote:unix_stream_socket { read write connectto setopt }; 178 179# Communicate over a socket created by app_zygote. 180allow system_server app_zygote:unix_stream_socket { read write connectto setopt }; 181 182# Perform Binder IPC. 183binder_use(system_server) 184binder_call(system_server, appdomain) 185binder_call(system_server, binderservicedomain) 186binder_call(system_server, dumpstate) 187binder_call(system_server, fingerprintd) 188binder_call(system_server, gatekeeperd) 189binder_call(system_server, idmap) 190binder_call(system_server, installd) 191binder_call(system_server, incidentd) 192binder_call(system_server, iorapd) 193binder_call(system_server, netd) 194binder_call(system_server, notify_traceur) 195binder_call(system_server, statsd) 196binder_call(system_server, storaged) 197binder_call(system_server, update_engine) 198binder_call(system_server, vold) 199binder_call(system_server, wificond) 200binder_call(system_server, wpantund) 201userdebug_or_eng(` 202 binder_call(system_server, perfprofd) 203') 204binder_service(system_server) 205 206# Use HALs 207hal_client_domain(system_server, hal_allocator) 208hal_client_domain(system_server, hal_authsecret) 209hal_client_domain(system_server, hal_broadcastradio) 210hal_client_domain(system_server, hal_codec2) 211hal_client_domain(system_server, hal_configstore) 212hal_client_domain(system_server, hal_contexthub) 213hal_client_domain(system_server, hal_face) 214hal_client_domain(system_server, hal_fingerprint) 215hal_client_domain(system_server, hal_gnss) 216hal_client_domain(system_server, hal_graphics_allocator) 217hal_client_domain(system_server, hal_health) 218hal_client_domain(system_server, hal_input_classifier) 219hal_client_domain(system_server, hal_ir) 220hal_client_domain(system_server, hal_light) 221hal_client_domain(system_server, hal_memtrack) 222hal_client_domain(system_server, hal_neuralnetworks) 223hal_client_domain(system_server, hal_oemlock) 224hal_client_domain(system_server, hal_omx) 225hal_client_domain(system_server, hal_power) 226hal_client_domain(system_server, hal_power_stats) 227hal_client_domain(system_server, hal_sensors) 228hal_client_domain(system_server, hal_tetheroffload) 229hal_client_domain(system_server, hal_thermal) 230hal_client_domain(system_server, hal_tv_cec) 231hal_client_domain(system_server, hal_tv_input) 232hal_client_domain(system_server, hal_usb) 233hal_client_domain(system_server, hal_usb_gadget) 234hal_client_domain(system_server, hal_vibrator) 235hal_client_domain(system_server, hal_vr) 236hal_client_domain(system_server, hal_weaver) 237hal_client_domain(system_server, hal_wifi) 238hal_client_domain(system_server, hal_wifi_hostapd) 239hal_client_domain(system_server, hal_wifi_offload) 240hal_client_domain(system_server, hal_wifi_supplicant) 241 242# Talk with graphics composer fences 243allow system_server hal_graphics_composer:fd use; 244 245# Use RenderScript always-passthrough HAL 246allow system_server hal_renderscript_hwservice:hwservice_manager find; 247allow system_server same_process_hal_file:file { execute read open getattr map }; 248 249# Talk to tombstoned to get ANR traces. 250unix_socket_connect(system_server, tombstoned_intercept, tombstoned) 251 252# List HAL interfaces to get ANR traces. 253allow system_server hwservicemanager:hwservice_manager list; 254 255# Send signals to trigger ANR traces. 256allow system_server { 257 # This is derived from the list that system server defines as interesting native processes 258 # to dump during ANRs or watchdog aborts, defined in NATIVE_STACKS_OF_INTEREST in 259 # frameworks/base/services/core/java/com/android/server/Watchdog.java. 260 audioserver 261 cameraserver 262 drmserver 263 gpuservice 264 inputflinger 265 mediadrmserver 266 mediaextractor 267 mediametrics 268 mediaserver 269 mediaswcodec 270 sdcardd 271 statsd 272 surfaceflinger 273 vold 274 275 # This list comes from HAL_INTERFACES_OF_INTEREST in 276 # frameworks/base/services/core/java/com/android/server/Watchdog.java. 277 hal_audio_server 278 hal_bluetooth_server 279 hal_camera_server 280 hal_codec2_server 281 hal_face_server 282 hal_graphics_allocator_server 283 hal_graphics_composer_server 284 hal_health_server 285 hal_omx_server 286 hal_power_stats_server 287 hal_sensors_server 288 hal_vr_server 289}:process { signal }; 290 291# Use sockets received over binder from various services. 292allow system_server audioserver:tcp_socket rw_socket_perms; 293allow system_server audioserver:udp_socket rw_socket_perms; 294allow system_server mediaserver:tcp_socket rw_socket_perms; 295allow system_server mediaserver:udp_socket rw_socket_perms; 296 297# Use sockets received over binder from various services. 298allow system_server mediadrmserver:tcp_socket rw_socket_perms; 299allow system_server mediadrmserver:udp_socket rw_socket_perms; 300 301# Get file context 302allow system_server file_contexts_file:file r_file_perms; 303# access for mac_permissions 304allow system_server mac_perms_file: file r_file_perms; 305# Check SELinux permissions. 306selinux_check_access(system_server) 307 308allow system_server sysfs_type:dir search; 309 310r_dir_file(system_server, sysfs_android_usb) 311allow system_server sysfs_android_usb:file w_file_perms; 312 313allow system_server sysfs_extcon:dir r_dir_perms; 314 315r_dir_file(system_server, sysfs_ipv4) 316allow system_server sysfs_ipv4:file w_file_perms; 317 318r_dir_file(system_server, sysfs_rtc) 319r_dir_file(system_server, sysfs_switch) 320r_dir_file(system_server, sysfs_wakeup_reasons) 321 322allow system_server sysfs_nfc_power_writable:file rw_file_perms; 323allow system_server sysfs_mac_address:file r_file_perms; 324allow system_server sysfs_power:dir search; 325allow system_server sysfs_power:file rw_file_perms; 326allow system_server sysfs_thermal:dir search; 327allow system_server sysfs_thermal:file r_file_perms; 328 329# TODO: Remove when HALs are forced into separate processes 330allow system_server sysfs_vibrator:file { write append }; 331 332# TODO: added to match above sysfs rule. Remove me? 333allow system_server sysfs_usb:file w_file_perms; 334 335# Access devices. 336allow system_server device:dir r_dir_perms; 337allow system_server mdns_socket:sock_file rw_file_perms; 338allow system_server gpu_device:chr_file rw_file_perms; 339allow system_server input_device:dir r_dir_perms; 340allow system_server input_device:chr_file rw_file_perms; 341allow system_server tty_device:chr_file rw_file_perms; 342allow system_server usbaccessory_device:chr_file rw_file_perms; 343allow system_server video_device:dir r_dir_perms; 344allow system_server video_device:chr_file rw_file_perms; 345allow system_server adbd_socket:sock_file rw_file_perms; 346allow system_server rtc_device:chr_file rw_file_perms; 347allow system_server audio_device:dir r_dir_perms; 348 349# write access to ALSA interfaces (/dev/snd/*) needed for MIDI 350allow system_server audio_device:chr_file rw_file_perms; 351 352# tun device used for 3rd party vpn apps 353allow system_server tun_device:chr_file rw_file_perms; 354allowxperm system_server tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF }; 355 356# Manage data/ota_package 357allow system_server ota_package_file:dir rw_dir_perms; 358allow system_server ota_package_file:file create_file_perms; 359 360# Manage system data files. 361allow system_server system_data_file:dir create_dir_perms; 362allow system_server system_data_file:notdevfile_class_set create_file_perms; 363allow system_server packages_list_file:file create_file_perms; 364allow system_server keychain_data_file:dir create_dir_perms; 365allow system_server keychain_data_file:file create_file_perms; 366allow system_server keychain_data_file:lnk_file create_file_perms; 367 368# Manage /data/app. 369allow system_server apk_data_file:dir create_dir_perms; 370allow system_server apk_data_file:{ file lnk_file } { create_file_perms link }; 371allow system_server apk_tmp_file:dir create_dir_perms; 372allow system_server apk_tmp_file:file create_file_perms; 373 374# Access input configuration files in the /vendor directory 375r_dir_file(system_server, vendor_keylayout_file) 376r_dir_file(system_server, vendor_keychars_file) 377r_dir_file(system_server, vendor_idc_file) 378 379# Access /vendor/{app,framework,overlay} 380r_dir_file(system_server, vendor_app_file) 381r_dir_file(system_server, vendor_framework_file) 382r_dir_file(system_server, vendor_overlay_file) 383 384# Manage /data/app-private. 385allow system_server apk_private_data_file:dir create_dir_perms; 386allow system_server apk_private_data_file:file create_file_perms; 387allow system_server apk_private_tmp_file:dir create_dir_perms; 388allow system_server apk_private_tmp_file:file create_file_perms; 389 390# Manage files within asec containers. 391allow system_server asec_apk_file:dir create_dir_perms; 392allow system_server asec_apk_file:file create_file_perms; 393allow system_server asec_public_file:file create_file_perms; 394 395# Manage /data/anr. 396# 397# TODO: Some of these permissions can be withdrawn once we've switched to the 398# new stack dumping mechanism, see b/32064548 and the rules below. In particular, 399# the system_server should never need to create a new anr_data_file:file or write 400# to one, but it will still need to read and append to existing files. 401allow system_server anr_data_file:dir create_dir_perms; 402allow system_server anr_data_file:file create_file_perms; 403 404# New stack dumping scheme : request an output FD from tombstoned via a unix 405# domain socket. 406# 407# Allow system_server to connect and write to the tombstoned java trace socket in 408# order to dump its traces. Also allow the system server to write its traces to 409# dumpstate during bugreport capture and incidentd during incident collection. 410unix_socket_connect(system_server, tombstoned_java_trace, tombstoned) 411allow system_server tombstoned:fd use; 412allow system_server dumpstate:fifo_file append; 413allow system_server incidentd:fifo_file append; 414# Write to a pipe created from `adb shell` (for debuggerd -j `pidof system_server`) 415userdebug_or_eng(` 416 allow system_server su:fifo_file append; 417') 418 419# Allow system_server to read pipes from incidentd (used to deliver incident reports 420# to dropbox) 421allow system_server incidentd:fifo_file read; 422 423# Read /data/misc/incidents - only read. The fd will be sent over binder, 424# with no DAC access to it, for dropbox to read. 425allow system_server incident_data_file:file read; 426 427# Allow dropbox to read /data/misc/perfetto-traces. Only the fd is sent over 428# binder. 429allow system_server perfetto_traces_data_file:file read; 430allow system_server perfetto:fd use; 431 432# Allow dropbox to read /data/misc/perfprofd. Only the fd is sent over binder. 433userdebug_or_eng(` 434 allow system_server perfprofd_data_file:file { getattr read }; 435 allow system_server perfprofd:fd use; 436') 437 438# Manage /data/backup. 439allow system_server backup_data_file:dir create_dir_perms; 440allow system_server backup_data_file:file create_file_perms; 441 442# Write to /data/system/dropbox 443allow system_server dropbox_data_file:dir create_dir_perms; 444allow system_server dropbox_data_file:file create_file_perms; 445 446# Write to /data/system/heapdump 447allow system_server heapdump_data_file:dir rw_dir_perms; 448allow system_server heapdump_data_file:file create_file_perms; 449 450# Manage /data/misc/adb. 451allow system_server adb_keys_file:dir create_dir_perms; 452allow system_server adb_keys_file:file create_file_perms; 453 454# Manage /data/misc/network_watchlist 455allow system_server network_watchlist_data_file:dir create_dir_perms; 456allow system_server network_watchlist_data_file:file create_file_perms; 457 458# Manage /data/misc/sms. 459# TODO: Split into a separate type? 460allow system_server radio_data_file:dir create_dir_perms; 461allow system_server radio_data_file:file create_file_perms; 462 463# Manage /data/misc/systemkeys. 464allow system_server systemkeys_data_file:dir create_dir_perms; 465allow system_server systemkeys_data_file:file create_file_perms; 466 467# Manage /data/misc/textclassifier. 468allow system_server textclassifier_data_file:dir create_dir_perms; 469allow system_server textclassifier_data_file:file create_file_perms; 470 471# Access /data/tombstones. 472allow system_server tombstone_data_file:dir r_dir_perms; 473allow system_server tombstone_data_file:file r_file_perms; 474 475# Manage /data/misc/vpn. 476allow system_server vpn_data_file:dir create_dir_perms; 477allow system_server vpn_data_file:file create_file_perms; 478 479# Manage /data/misc/wifi. 480allow system_server wifi_data_file:dir create_dir_perms; 481allow system_server wifi_data_file:file create_file_perms; 482 483# Manage /data/misc/zoneinfo. 484allow system_server zoneinfo_data_file:dir create_dir_perms; 485allow system_server zoneinfo_data_file:file create_file_perms; 486 487# Manage /data/app-staging. 488allow system_server staging_data_file:dir create_dir_perms; 489allow system_server staging_data_file:file create_file_perms; 490 491# Walk /data/data subdirectories. 492# Types extracted from seapp_contexts type= fields. 493allow system_server { 494 system_app_data_file 495 bluetooth_data_file 496 nfc_data_file 497 radio_data_file 498 shell_data_file 499 app_data_file 500 privapp_data_file 501}:dir { getattr read search }; 502 503# Also permit for unlabeled /data/data subdirectories and 504# for unlabeled asec containers on upgrades from 4.2. 505allow system_server unlabeled:dir r_dir_perms; 506# Read pkg.apk file before it has been relabeled by vold. 507allow system_server unlabeled:file r_file_perms; 508 509# Populate com.android.providers.settings/databases/settings.db. 510allow system_server system_app_data_file:dir create_dir_perms; 511allow system_server system_app_data_file:file create_file_perms; 512 513# Receive and use open app data files passed over binder IPC. 514# Types extracted from seapp_contexts type= fields. 515allow system_server { 516 system_app_data_file 517 bluetooth_data_file 518 nfc_data_file 519 radio_data_file 520 shell_data_file 521 app_data_file 522 privapp_data_file 523}:file { getattr read write append map }; 524 525# Access to /data/media for measuring disk usage. 526allow system_server media_rw_data_file:dir { search getattr open read }; 527 528# Receive and use open /data/media files passed over binder IPC. 529# Also used for measuring disk usage. 530allow system_server media_rw_data_file:file { getattr read write append }; 531 532# System server needs to setfscreate to packages_list_file when writing 533# /data/system/packages.list 534allow system_server system_server:process setfscreate; 535 536# Relabel apk files. 537allow system_server { apk_tmp_file apk_private_tmp_file }:{ dir file } { relabelfrom relabelto }; 538allow system_server { apk_data_file apk_private_data_file }:{ dir file } { relabelfrom relabelto }; 539 540# Relabel wallpaper. 541allow system_server system_data_file:file relabelfrom; 542allow system_server wallpaper_file:file relabelto; 543allow system_server wallpaper_file:file { rw_file_perms rename unlink }; 544 545# Backup of wallpaper imagery uses temporary hard links to avoid data churn 546allow system_server { system_data_file wallpaper_file }:file link; 547 548# ShortcutManager icons 549allow system_server system_data_file:dir relabelfrom; 550allow system_server shortcut_manager_icons:dir { create_dir_perms relabelto }; 551allow system_server shortcut_manager_icons:file create_file_perms; 552 553# Manage ringtones. 554allow system_server ringtone_file:dir { create_dir_perms relabelto }; 555allow system_server ringtone_file:file create_file_perms; 556 557# Relabel icon file. 558allow system_server icon_file:file relabelto; 559allow system_server icon_file:file { rw_file_perms unlink }; 560 561# FingerprintService.java does a restorecon of the directory /data/system/users/[0-9]+/fpdata(/.*)? 562allow system_server system_data_file:dir relabelfrom; 563 564# server_configurable_flags_data_file is used for storing server configurable flags which 565# have been reset during current booting. system_server needs to read the data to perform related 566# disaster recovery actions. 567allow system_server server_configurable_flags_data_file:dir r_dir_perms; 568allow system_server server_configurable_flags_data_file:file r_file_perms; 569 570# Property Service write 571set_prop(system_server, system_prop) 572set_prop(system_server, exported_system_prop) 573set_prop(system_server, exported2_system_prop) 574set_prop(system_server, exported3_system_prop) 575set_prop(system_server, safemode_prop) 576set_prop(system_server, theme_prop) 577set_prop(system_server, dhcp_prop) 578set_prop(system_server, net_radio_prop) 579set_prop(system_server, net_dns_prop) 580set_prop(system_server, system_radio_prop) 581set_prop(system_server, exported_system_radio_prop) 582set_prop(system_server, debug_prop) 583set_prop(system_server, powerctl_prop) 584set_prop(system_server, fingerprint_prop) 585set_prop(system_server, exported_fingerprint_prop) 586set_prop(system_server, device_logging_prop) 587set_prop(system_server, dumpstate_options_prop) 588set_prop(system_server, overlay_prop) 589set_prop(system_server, exported_overlay_prop) 590set_prop(system_server, pm_prop) 591set_prop(system_server, exported_pm_prop) 592userdebug_or_eng(`set_prop(system_server, wifi_log_prop)') 593 594# ctl interface 595set_prop(system_server, ctl_default_prop) 596set_prop(system_server, ctl_bugreport_prop) 597set_prop(system_server, ctl_gsid_prop) 598 599# cppreopt property 600set_prop(system_server, cppreopt_prop) 601 602# server configurable flags properties 603set_prop(system_server, device_config_input_native_boot_prop) 604set_prop(system_server, device_config_netd_native_prop) 605set_prop(system_server, device_config_activity_manager_native_boot_prop) 606set_prop(system_server, device_config_runtime_native_boot_prop) 607set_prop(system_server, device_config_runtime_native_prop) 608set_prop(system_server, device_config_media_native_prop) 609 610# BootReceiver to read ro.boot.bootreason 611get_prop(system_server, bootloader_boot_reason_prop) 612# PowerManager to read sys.boot.reason 613get_prop(system_server, system_boot_reason_prop) 614 615# Collect metrics on boot time created by init 616get_prop(system_server, boottime_prop) 617 618# Read device's serial number from system properties 619get_prop(system_server, serialno_prop) 620 621# Read/write the property which keeps track of whether this is the first start of system_server 622set_prop(system_server, firstboot_prop) 623 624# Audio service in system server can read exported audio properties, 625# such as camera shutter enforcement 626get_prop(system_server, exported_audio_prop) 627 628# system server reads this property to keep track of whether server configurable flags have been 629# reset during current boot. 630get_prop(system_server, device_config_reset_performed_prop) 631 632# Read/write the property that enables Test Harness Mode 633set_prop(system_server, test_harness_prop) 634 635# Read gsid.image_running. 636get_prop(system_server, gsid_prop) 637 638# Create a socket for connections from debuggerd. 639allow system_server system_ndebug_socket:sock_file create_file_perms; 640 641# Manage cache files. 642allow system_server cache_file:lnk_file r_file_perms; 643allow system_server { cache_file cache_recovery_file }:dir { relabelfrom create_dir_perms }; 644allow system_server { cache_file cache_recovery_file }:file { relabelfrom create_file_perms }; 645allow system_server { cache_file cache_recovery_file }:fifo_file create_file_perms; 646 647allow system_server system_file:dir r_dir_perms; 648allow system_server system_file:lnk_file r_file_perms; 649 650# ART locks profile files. 651allow system_server system_file:file lock; 652 653# LocationManager(e.g, GPS) needs to read and write 654# to uart driver and ctrl proc entry 655allow system_server gps_control:file rw_file_perms; 656 657# Allow system_server to use app-created sockets and pipes. 658allow system_server appdomain:{ tcp_socket udp_socket } { getattr getopt setopt read write shutdown }; 659allow system_server appdomain:{ fifo_file unix_stream_socket } { getattr read write }; 660 661# BackupManagerService needs to manipulate backup data files 662allow system_server cache_backup_file:dir rw_dir_perms; 663allow system_server cache_backup_file:file create_file_perms; 664# LocalTransport works inside /cache/backup 665allow system_server cache_private_backup_file:dir create_dir_perms; 666allow system_server cache_private_backup_file:file create_file_perms; 667 668# Allow system to talk to usb device 669allow system_server usb_device:chr_file rw_file_perms; 670allow system_server usb_device:dir r_dir_perms; 671 672# Read from HW RNG (needed by EntropyMixer). 673allow system_server hw_random_device:chr_file r_file_perms; 674 675# Read and delete files under /dev/fscklogs. 676r_dir_file(system_server, fscklogs) 677allow system_server fscklogs:dir { write remove_name }; 678allow system_server fscklogs:file unlink; 679 680# logd access, system_server inherit logd write socket 681# (urge is to deprecate this long term) 682allow system_server zygote:unix_dgram_socket write; 683 684# Read from log daemon. 685read_logd(system_server) 686read_runtime_log_tags(system_server) 687 688# Be consistent with DAC permissions. Allow system_server to write to 689# /sys/module/lowmemorykiller/parameters/adj 690# /sys/module/lowmemorykiller/parameters/minfree 691allow system_server sysfs_lowmemorykiller:file { getattr w_file_perms }; 692 693# Read /sys/fs/pstore/console-ramoops 694# Don't worry about overly broad permissions for now, as there's 695# only one file in /sys/fs/pstore 696allow system_server pstorefs:dir r_dir_perms; 697allow system_server pstorefs:file r_file_perms; 698 699# /sys access 700allow system_server sysfs_zram:dir search; 701allow system_server sysfs_zram:file rw_file_perms; 702 703add_service(system_server, system_server_service); 704allow system_server audioserver_service:service_manager find; 705allow system_server batteryproperties_service:service_manager find; 706allow system_server cameraserver_service:service_manager find; 707allow system_server dnsresolver_service:service_manager find; 708allow system_server drmserver_service:service_manager find; 709allow system_server dumpstate_service:service_manager find; 710allow system_server fingerprintd_service:service_manager find; 711allow system_server gatekeeper_service:service_manager find; 712allow system_server gpu_service:service_manager find; 713allow system_server gsi_service:service_manager find; 714allow system_server hal_fingerprint_service:service_manager find; 715allow system_server idmap_service:service_manager find; 716allow system_server incident_service:service_manager find; 717allow system_server installd_service:service_manager find; 718allow system_server iorapd_service:service_manager find; 719allow system_server keystore_service:service_manager find; 720allow system_server mediaserver_service:service_manager find; 721allow system_server mediametrics_service:service_manager find; 722allow system_server mediaextractor_service:service_manager find; 723allow system_server mediacodec_service:service_manager find; 724allow system_server mediadrmserver_service:service_manager find; 725allow system_server netd_service:service_manager find; 726allow system_server nfc_service:service_manager find; 727allow system_server radio_service:service_manager find; 728allow system_server stats_service:service_manager find; 729allow system_server storaged_service:service_manager find; 730allow system_server surfaceflinger_service:service_manager find; 731allow system_server update_engine_service:service_manager find; 732allow system_server vold_service:service_manager find; 733allow system_server wificond_service:service_manager find; 734userdebug_or_eng(` 735 allow system_server perfprofd_service:service_manager find; 736') 737 738add_service(system_server, batteryproperties_service) 739 740allow system_server keystore:keystore_key { 741 get_state 742 get 743 insert 744 delete 745 exist 746 list 747 reset 748 password 749 lock 750 unlock 751 is_empty 752 sign 753 verify 754 grant 755 duplicate 756 clear_uid 757 add_auth 758 user_changed 759}; 760 761# Allow system server to search and write to the persistent factory reset 762# protection partition. This block device does not get wiped in a factory reset. 763allow system_server block_device:dir search; 764allow system_server frp_block_device:blk_file rw_file_perms; 765allowxperm system_server frp_block_device:blk_file ioctl { BLKSECDISCARD BLKDISCARD }; 766 767# Clean up old cgroups 768allow system_server cgroup:dir { remove_name rmdir }; 769 770# /oem access 771r_dir_file(system_server, oemfs) 772 773# Allow resolving per-user storage symlinks 774allow system_server { mnt_user_file storage_file }:dir { getattr search }; 775allow system_server { mnt_user_file storage_file }:lnk_file { getattr read }; 776 777# Allow statfs() on storage devices, which happens fast enough that 778# we shouldn't be killed during unsafe removal 779allow system_server sdcard_type:dir { getattr search }; 780 781# Traverse into expanded storage 782allow system_server mnt_expand_file:dir r_dir_perms; 783 784# Allow system process to relabel the fingerprint directory after mkdir 785# and delete the directory and files when no longer needed 786allow system_server fingerprintd_data_file:dir { r_dir_perms remove_name rmdir relabelto write }; 787allow system_server fingerprintd_data_file:file { getattr unlink }; 788 789# Allow system process to read network MAC address 790allow system_server sysfs_mac_address:file r_file_perms; 791 792userdebug_or_eng(` 793 # Allow system server to create and write method traces in /data/misc/trace. 794 allow system_server method_trace_data_file:dir w_dir_perms; 795 allow system_server method_trace_data_file:file { create w_file_perms }; 796 797 # Allow system server to read dmesg 798 allow system_server kernel:system syslog_read; 799 800 # Allow writing and removing window traces in /data/misc/wmtrace. 801 allow system_server wm_trace_data_file:dir rw_dir_perms; 802 allow system_server wm_trace_data_file:file { getattr setattr create unlink w_file_perms }; 803') 804 805# For AppFuse. 806allow system_server vold:fd use; 807allow system_server fuse_device:chr_file { read write ioctl getattr }; 808allow system_server app_fuse_file:file { read write getattr }; 809 810# For configuring sdcardfs 811allow system_server configfs:dir { create_dir_perms }; 812allow system_server configfs:file { getattr open create unlink write }; 813 814# Connect to adbd and use a socket transferred from it. 815# Used for e.g. jdwp. 816allow system_server adbd:unix_stream_socket connectto; 817allow system_server adbd:fd use; 818allow system_server adbd:unix_stream_socket { getattr getopt ioctl read write shutdown }; 819 820# Allow invoking tools like "timeout" 821allow system_server toolbox_exec:file rx_file_perms; 822 823# Allow system process to setup and measure fs-verity 824allowxperm system_server apk_data_file:file ioctl { 825 FS_IOC_ENABLE_VERITY FS_IOC_MEASURE_VERITY 826}; 827 828# Postinstall 829# 830# For OTA dexopt, allow calls coming from postinstall. 831binder_call(system_server, postinstall) 832 833allow system_server postinstall:fifo_file write; 834allow system_server update_engine:fd use; 835allow system_server update_engine:fifo_file write; 836 837# Access to /data/preloads 838allow system_server preloads_data_file:file { r_file_perms unlink }; 839allow system_server preloads_data_file:dir { r_dir_perms write remove_name rmdir }; 840allow system_server preloads_media_file:file { r_file_perms unlink }; 841allow system_server preloads_media_file:dir { r_dir_perms write remove_name rmdir }; 842 843r_dir_file(system_server, cgroup) 844allow system_server ion_device:chr_file r_file_perms; 845 846r_dir_file(system_server, proc_asound) 847r_dir_file(system_server, proc_net_type) 848r_dir_file(system_server, proc_qtaguid_stat) 849allow system_server { 850 proc_cmdline 851 proc_loadavg 852 proc_meminfo 853 proc_pagetypeinfo 854 proc_pipe_conf 855 proc_stat 856 proc_uid_cputime_showstat 857 proc_uid_io_stats 858 proc_uid_time_in_state 859 proc_uid_concurrent_active_time 860 proc_uid_concurrent_policy_time 861 proc_version 862 proc_vmallocinfo 863}:file r_file_perms; 864 865allow system_server proc_uid_time_in_state:dir r_dir_perms; 866allow system_server proc_uid_cpupower:file r_file_perms; 867 868r_dir_file(system_server, rootfs) 869 870# Allow WifiService to start, stop, and read wifi-specific trace events. 871allow system_server debugfs_tracing_instances:dir search; 872allow system_server debugfs_wifi_tracing:dir search; 873allow system_server debugfs_wifi_tracing:file rw_file_perms; 874 875# allow system_server to exec shell, asanwrapper & zygote(app_process) on ASAN builds. Needed to run 876# asanwrapper. 877with_asan(` 878 allow system_server shell_exec:file rx_file_perms; 879 allow system_server asanwrapper_exec:file rx_file_perms; 880 allow system_server zygote_exec:file rx_file_perms; 881') 882 883# allow system_server to read the eBPF maps that stores the traffic stats information and update 884# the map after snapshot is recorded 885allow system_server fs_bpf:dir search; 886allow system_server fs_bpf:file { read write }; 887allow system_server bpfloader:bpf { map_read map_write }; 888 889# ART Profiles. 890# Allow system_server to open profile snapshots for read. 891# System server never reads the actual content. It passes the descriptor to 892# to privileged apps which acquire the permissions to inspect the profiles. 893allow system_server user_profile_data_file:dir { getattr search }; 894allow system_server user_profile_data_file:file { getattr open read }; 895 896# System server may dump profile data for debuggable apps in the /data/misc/profman. 897# As such it needs to be able create files but it should never read from them. 898allow system_server profman_dump_data_file:file { create getattr setattr w_file_perms}; 899allow system_server profman_dump_data_file:dir w_dir_perms; 900 901# On userdebug build we may profile system server. Allow it to write and create its own profile. 902userdebug_or_eng(` 903 allow system_server user_profile_data_file:file create_file_perms; 904') 905 906# UsbDeviceManager uses /dev/usb-ffs 907allow system_server functionfs:dir search; 908allow system_server functionfs:file rw_file_perms; 909 910# system_server contains time / time zone detection logic so reads the associated properties. 911get_prop(system_server, time_prop) 912 913### 914### Neverallow rules 915### 916### system_server should NEVER do any of this 917 918# Do not allow opening files from external storage as unsafe ejection 919# could cause the kernel to kill the system_server. 920neverallow system_server sdcard_type:dir { open read write }; 921neverallow system_server sdcard_type:file rw_file_perms; 922 923# system server should never be operating on zygote spawned app data 924# files directly. Rather, they should always be passed via a 925# file descriptor. 926# Types extracted from seapp_contexts type= fields, excluding 927# those types that system_server needs to open directly. 928neverallow system_server { 929 bluetooth_data_file 930 nfc_data_file 931 shell_data_file 932 app_data_file 933 privapp_data_file 934}:file { open create unlink link }; 935 936# Forking and execing is inherently dangerous and racy. See, for 937# example, https://www.linuxprogrammingblog.com/threads-and-fork-think-twice-before-using-them 938# Prevent the addition of new file execs to stop the problem from 939# getting worse. b/28035297 940neverallow system_server { 941 file_type 942 -toolbox_exec 943 -logcat_exec 944 with_asan(`-shell_exec -asanwrapper_exec -zygote_exec') 945}:file execute_no_trans; 946 947# Ensure that system_server doesn't perform any domain transitions other than 948# transitioning to the crash_dump domain when a crash occurs. 949neverallow system_server { domain -crash_dump }:process transition; 950neverallow system_server *:process dyntransition; 951 952# Only allow crash_dump to connect to system_ndebug_socket. 953neverallow { domain -init -system_server -crash_dump } system_ndebug_socket:sock_file { open write }; 954 955# Only allow init, system_server, flags_health_check to set properties for server configurable flags 956neverallow { 957 domain 958 -init 959 -system_server 960 -flags_health_check 961} { 962 device_config_activity_manager_native_boot_prop 963 device_config_input_native_boot_prop 964 device_config_netd_native_prop 965 device_config_runtime_native_boot_prop 966 device_config_runtime_native_prop 967 device_config_media_native_prop 968}:property_service set; 969 970# system_server should never be executing dex2oat. This is either 971# a bug (for example, bug 16317188), or represents an attempt by 972# system server to dynamically load a dex file, something we do not 973# want to allow. 974neverallow system_server dex2oat_exec:file no_x_file_perms; 975 976# system_server should never execute or load executable shared libraries 977# in /data. Executable files in /data are a persistence vector. 978# https://bugs.chromium.org/p/project-zero/issues/detail?id=955 for example. 979neverallow system_server data_file_type:file no_x_file_perms; 980 981# The only block device system_server should be accessing is 982# the frp_block_device. This helps avoid a system_server to root 983# escalation by writing to raw block devices. 984neverallow system_server { dev_type -frp_block_device }:blk_file no_rw_file_perms; 985 986# system_server should never use JIT functionality 987# See https://googleprojectzero.blogspot.com/2016/12/bitunmap-attacking-android-ashmem.html 988# in the section titled "A Short ROP Chain" for why. 989neverallow system_server self:process execmem; 990neverallow system_server ashmem_device:chr_file execute; 991 992# TODO: deal with tmpfs_domain pub/priv split properly 993neverallow system_server system_server_tmpfs:file execute; 994 995# Resources handed off by system_server_startup 996allow system_server system_server_startup:fd use; 997allow system_server system_server_startup_tmpfs:file { read write map }; 998allow system_server system_server_startup:unix_dgram_socket write; 999 1000# Allow system server to communicate to apexd 1001allow system_server apex_service:service_manager find; 1002allow system_server apexd:binder call; 1003 1004# Allow system server to communicate to system-suspend's control interface 1005allow system_server system_suspend_control_service:service_manager find; 1006binder_call(system_server, system_suspend) 1007binder_call(system_suspend, system_server) 1008 1009# Allow system server to communicate to system-suspend's wakelock interface 1010wakelock_use(system_server) 1011 1012# Allow the system server to read files under /data/apex. The system_server 1013# needs these privileges to compare file signatures while processing installs. 1014# 1015# Only apexd is allowed to create new entries or write to any file under /data/apex. 1016allow system_server apex_data_file:dir { getattr search }; 1017allow system_server apex_data_file:file r_file_perms; 1018 1019# Allow PasswordSlotManager rw access to /metadata/password_slots, so GSIs and the host image can 1020# communicate which slots are available for use. 1021allow system_server metadata_file:dir search; 1022allow system_server password_slot_metadata_file:dir rw_dir_perms; 1023allow system_server password_slot_metadata_file:file create_file_perms; 1024 1025# Read/Write /proc/pressure/memory 1026allow system_server proc_pressure_mem:file rw_file_perms; 1027 1028# dexoptanalyzer is currently used only for secondary dex files which 1029# system_server should never access. 1030neverallow system_server dexoptanalyzer_exec:file no_x_file_perms; 1031 1032# No ptracing others 1033neverallow system_server { domain -system_server }:process ptrace; 1034 1035# CAP_SYS_RESOURCE was traditionally needed for sensitive /proc/PID 1036# file read access. However, that is now unnecessary (b/34951864) 1037neverallow system_server system_server:global_capability_class_set sys_resource; 1038 1039# Only system_server/init should access /metadata/password_slots. 1040neverallow { domain -init -system_server } password_slot_metadata_file:dir *; 1041neverallow { 1042 domain 1043 -init 1044 -system_server 1045} password_slot_metadata_file:notdevfile_class_set ~{ relabelto getattr }; 1046neverallow { domain -init -system_server } password_slot_metadata_file:notdevfile_class_set *; 1047